diff --git a/docs/org-audit-2026-06-04.md b/docs/org-audit-2026-06-04.md
index 7da069b..0e00256 100644
--- a/docs/org-audit-2026-06-04.md
+++ b/docs/org-audit-2026-06-04.md
@@ -37,11 +37,13 @@
   - _Target: GitHub-owned + Marketplace-verified + `peaceiris/*`, `ruby/*`_
   - _Can do before Saturday — no breakage_
 
-- [ ] **5. Enable secret scanning + push protection org-wide** — Settings → Code security and analysis → "Enable all"
-  - _Include in Slack announcement_
+- ⏳ **5. Enable secret scanning + push protection org-wide** — Settings → Code security and analysis → "Enable all"
+  - _Announce in Slack first (#general), then enable after notice period_
+  - _Table for Saturday_
 
-- [ ] **6. Enable Dependabot alerts org-wide** — Settings → Code security and analysis → "Enable all"
-  - _Include in Slack announcement_
+- ⏳ **6. Enable Dependabot alerts org-wide** — Settings → Code security and analysis → "Enable all"
+  - _Announce in Slack first (#general), then enable after notice period_
+  - _Table for Saturday_
 
 ---